ci: cosign images (#26)

miracum · Aug 19, 2021 · 0d74e60 · 0d74e60
1 parent e51a656
commit 0d74e60
Showing 1 changed file with 18 additions and 0 deletions.
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -105,6 +105,24 @@ jobs:
           platforms: ${{ steps.platforms.outputs.platforms }}
       - name: Print Image digest
         run: echo ${{ steps.docker_build.outputs.digest }}
+      - name: Install Cosign
+        if: ${{ github.event_name != 'pull_request' }}
+        uses: sigstore/cosign-installer@main
+      - name: Store signing key in tmp file
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          COSIGN_KEY: ${{ secrets.MIRACUM_COSIGN_PRIVATE_KEY }}
+        run: echo "$COSIGN_KEY" > /tmp/cosign.key
+      - name: Sign images
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          COSIGN_PASSWORD: ${{ secrets.MIRACUM_COSIGN_PASSWORD }}
+          IMAGES: ${{ steps.docker_meta.outputs.tags }}
+        run: |
+          while read -r image; do
+            echo "Signing $image"
+            cosign sign -key /tmp/cosign.key "$image"
+          done <<< "$IMAGES"
   release:
     needs: build
     name: Release